Upgrade Doorkeeper to 4.2.0

Doorkeeper 4.2.0 was recently released to address CVE-2016-6582 and we've updated the gem accordingly.

Upgrade Hamlit to 2.6.1

The Hamlit library was vulnerable to the same CVE-2016-6316 issue that recently prompted an update for Rails. See the issue for more details.

GitLab versions prior to 8.10 are not using Hamlit and do not require this fix.

We'd like to thank Dylan Katz for responsibly disclosing this issue to us, and to Hamlit author Takashi Kokubun for quickly releasing a fix after we traced the cause back to the gem.

Upgrade barometer

These versions do not include any migrations, and should not require any downtime.

Please be aware that by default the Omnibus packages will stop, run migrations, and start again, no matter how “big” or “small” the upgrade is. This behavior can be changed by adding a /etc/gitlab/skip-auto-migrations file.